CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- curl, debian linux, siemens ruggedcom rst2428p +15 more +17 moreOut of bounds read for cookie path7.5 High
- welotec smartems web applicationPath Traversal via 'Upload-Key' in SmartEMS Upload Handling8.8 High
- heateor login – social login pluginHeateor Login – Social Login Plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- martins56 pagbank / pagseguro connect para woocommercePagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection4.9 Medium
- markohoven mybrain utilitiesMyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpallimport wp all import – drag & drop import for csv, xml, excel & google sheetsImport any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload7.2 High
- yonifre maspik – ultimate spam protectionMaspik <= 2.5.6 - Cross-Site Request Forgery4.3 Medium
- wpblast wp blast | seo & performance boosterWP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing4.3 Medium
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressWP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure7.7 High
- fernandiez auto save remote images (drafts)Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery6.4 Medium
- laki patel testimonialTestimonial <= 2.3 - Authenticated (Contributor+) SQL Injection6.5 Medium
- yonifre maspik – ultimate spam protectionMaspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export4.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting5.5 Medium
- nitropack – performance, page speed & cache plugin for core web vitals, cdn & image optimizationNitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax Function4.3 Medium
- peachpay — payments & express checkout for woocommerce (supports stripe, paypal, square, authorize.net, nmi)Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by Parameter6.5 Medium
- arjunthakur duplicate page and postDuplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter6.5 Medium
- dasinfomedia wpgym - wordpress gym management systemWPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover8.8 High
- nik00726 responsive filterable portfolioResponsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload7.2 High
- ideaboxcreations powerpack addons for elementor (free widgets, extensions and templates)PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'6.4 Medium
- hjsoft hcm human resources management systemHJSoft HCM Human Resources Management System downlawbase sql injection5.3 Medium
pcapplusplusOSS-FuzzHeap-buffer-overflow in pcpp::ArpLayer::toStringNo score- No product listedSeismic App com.seismic.doccenter AndroidManifest.xml improper export of android application components4.8 Medium
- sohamjuhin tourism management systemA Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and...7.2 High
- tenda f3 firmwareTenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the wifiTimeClose...5.6 Medium
- tenda f3 firmwareTenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList...5.6 Medium
- tenda f3 firmwareTenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow. via the macFilterList...5.6 Medium
- tenda f3 firmwareTenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the QosList parameter...5.6 Medium
- tenda f3 firmwareTenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the portList parameter...5.6 Medium
- techhub.p-m decap cmsDecap CMS Cross Site Scripting (XSS) vulnerability6.1 Medium
- benimposBenimPOS Masaustu 3.0.x is affected by insecure file permissions. The application installation...7.8 High
- No product listedAn issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and...5.7 Medium
- masterlifecrm dietlyHardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information.7.5 High
- fit2cloud 1panelOS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to...8.8 High
- utcms project utcmsA vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This...8.8 High
- No product listedAn issue was discovered in mcp-neo4j 0.3.0 allowing attackers to gain sensitive information or...7.5 High
- litmus mcp serverAn issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized...7.5 High
- mariadb model context protocolAn issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via...7.5 High
- intelbras iwr 3000n firmwareIntelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint....8.4 High
- easeus eudskacs.sys driverThe eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1 fails to...7.8 High
- aaluoxiang oa systemoasys v1.1 is vulnerable to Directory Traversal in ProcedureController.5.6 Medium
- google chromeInappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0...8.8 High
- google chromeUse after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a...8.8 High
- utt 750w, 750w firmware +1 moreUTT 750W formPictureUrl buffer overflow8.7 High
- ninofiliu interactive-git-checkoutinteractive-git-checkout has Command Injection vulnerability9.8 Critical
- himmelblau-idm himmelblauHimmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation)4.4 Medium
- pyinstallerPyInstaller has local privilege escalation vulnerability7.0 High
- prebid prebid-universal-creativePrebid Universal Creative on npm briefly compromised9.3 Critical
- rathenarAthena missing bound check in chclif_parse_moveCharSlot8.2 High
- rathenarAthena has SQL Injection in PartyBooking component via `WorldName` parameter.9.1 Critical
- rathenarAthena has heap-based buffer overflow in login server9.8 Critical
- Show moreLoading…